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IN THE UNITED STATES DESIGNATED/ELECTED OFFICE 
OF THE UNITED STATES PATENT AND TRADEMARK OFFICE 
UNDER THE PATENT COOPERATION TREATY-CHAPTER II 

APPLICANT(S): BERTIL BRANDIN ET AL 

ATTORNEY DOCKET NO.: P00,1982 

INTERNATIONAL APPLICATION NO: PCT/DE99/01 91 5 

INTERNATIONAL FILING DATE: 01 JULY 1 999 

INVENTION: METHOD AND ARRANGEMENT FOR DESIGNING 
THE CONTROL OF A COMPLETE PROCESS 

Assistant Commissioner for Patents, 
Washington D.C. 20231 

AMENDMENT A PRIOR TO ACTION 

Sir: 

Applicants herewith amend the above-referenced PCT application, and 
request entry of the Amendment prior to examination on the United States 
Examination Phase. 

IN THE CLAIMS : 
On page 13: 

replace line 1 with -WHAT IS CLAIMED IS:--; 

Please replace original claims 1-8 with the following rewritten claims 1-8, 
referring to the mark-ups in Appendix A. 

1 . (Amended) A method for designing a control of a complete process which 
comprises a number of individual processes, said method comprising the steps of: 

a) identifying functionalities of said individual processes; 

b) performing a validation by automatically verifying an interplay of said 
functionalities in accordance with an input to said complete process, while not 
impeding each individual process during an operation, producing a validation 
result; and 

c) determining data for controlling said complete process from said validation 
result. 
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2. (Amended) The method as claimed in claim 1, further comprising the step 
of performing a sequence optimization. 

5 3. (Amended) The method as claimed in claim 1 , further comprising the step 

of producing data for said control in an executable code form. 

4. (Amended) The method as claimed in claim 1 , further comprising the step 
of controlling individual affected processes by a software unit which is one of said 

10 functionalities of said individual processes. 

5. (Amended) The method as claimed in claim 1 , wherein one or more of 
said individual processes may be an impeding process, an impeding process being 
defined as such if one of the following conditions is met: 

15 a) an individual process is blocked by another individual process; and 

b) an individual process reaches an unauthorized state or a state endangering 
operation of said complete system. 

6. (Amended) The method as claimed in claim 1 , further comprising the 
20 steps of: 

designing an automatic placement machine; and 
controlling individual processes of said machine. 

7. (Amended) The method as claimed in claim 1, further comprising the step 
25 of controlling a technical installation with data determined for controlling said 

complete process. 

8. (Amended) An arrangement for designing the control of a complete 
process, comprising: 

30 a number of individual processes; and 
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a processor unit configured to provide: 

a) identification of functionalities of said individual processes; 

b) a validation, by automatically verifying an interplay of functionalities in 
accordance with an input to said complete process, in a manner such 
that each of said individual processes is not impeded during an 
operation; and 

c) data from a result of said validation that is used for controlling said 
complete process. 



REMARKS 

The present Amendment revises the specification and claims to conform to 
United States patent practice, before examination of the present PCT application in 
the United States National Examination Phase. Pursuant to 37 CFR 1.125 (b), 
applicants have concurrently submitted a substitute specification, excluding the 
claims, and provided a marked-up copy. All of the changes are editorial and 
applicant believes no new matter is added thereby. The amendment, addition, 
and/or cancellation of claims is not intended to be a surrender of any of the subject 
matter of those claims. 

Early examination on the merits is respectfully requested. 
Submitted by, 

/^^d- /S^eAcvMQ^ (Reg. No. 45,877) 
Mark Bergner ^ 
Schiff Hardin & Waite 
Patent Department 
6600 Sears Tower 
233 South Wacker Drive 
Chicago, Illinois 60606-6473 
(312) 258-5779 
Attorneys for Applicant 
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Appendix A 
Mark Ups for Claim Amendments 



This redlined draft, generated by CompareRite (TM) - The Instant Redliner, shows 
the differences between - 

original document : Q:\DOCUMENTS\YEAR 2000\P001 982-BRANDIN-\ORIGINAL 
CLAIMS.DOC 

and revised document: Q:\DOCUMENTS\YEAR 2000\P001982-BRANDIN- 
\AMENDED CLAIMS.DOC 

CompareRite found 55 change(s) in the text 

Deletions appear as Overstrike text surrounded by [] 
Additions appear as Bold-Underline text 

1 . (Amended) A method for designing {the} a control of a complete process 
which comprises a number of individual processes, said method comprising the 
steps of: 

a} identifying [ a ) in w hich] functionalities of {the} said individual processes {are 
identifi e d,] ; 

[b) in which] b) performing a validation [is p e rformed] by automatically verifying 

an interplay of {the} said functionalities in accordance with an input to {the} 
said complete process, [to the eff e ct that] while not impeding each 
individual process fis not impe d ed during th e ope rat i o n,! during an 
operation, producing a validation result; and 

[c) in which] c) determining data for controlling {the} said complete process 

[ a re det e rmin e d from a resu l t of the] from said validation result . 

2. (Amended) The method as claimed in claim 1 , [in which] further 
comprising the step of performing a sequence optimization [is perform e d in 
add i tio n to st e p 1 c).] . 

f£r4 3. (Amended) The method as claimed in claim 1 [or 2, in which th e data 
f o r the c ontrol are determined in the form of] , further comprising the step of 
producing data for said control in a n executable code form.f 4 

4 
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4. (Amended) The method as claimed in [on e of c laims 1 to 3, in wh i ch one 
of th e function a liti e s of th e individual processes is a softwar e unit for controlling th e 
individua l process affected.1 claim 1, further comprising the step of controlling 
5 individual affected processes by a software unit which is one of said 
functionalities of said individual processes. 

(Amended) The method as claimed in [on e of th e pr e ceding claims, in 
which a n individual process is imped e d] claim 1 f wherein one or more of said 
10 individual processes may be an impeding process, an impeding process being 
defined as such if one of the following conditions is met: 

a) {the] an individual process is blocked by another individual process; and 

b) {the} an individual process reaches an unauthorized state or a state 
endangering {the} operation of [the} said complete system. 

15 

6. (Amended) The method as claimed in [one of the prec e ding cla i ms, i n 
w hich the co ntrol of individua l processes ofl claim 1, further comprising the steps 

designing an automatic placement machine [ i s designed.] ; and 
20 f Mcontrolling individual processes of said machine, 

7. (Amended) The method as claimed in [o n e of t h e p re c ed ing claims, in 
which the! claim 1, further comprising the step of controlling a technical 
installation with data determined for controlling {the} said complete process {am 

25 us e d f or co n tro l lin g a technical installat i on. ] . 

i&r 48. (Amended) An arrangement for designing the control of a complete 
process [which compris e s! , comprising: 

a number of individual processes f, comprisi n g! ; and 
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a processor unit [which is s et up in su ch a mann e r that] configured to 
provide: 

{a>^a} identification of functionalities of {the} said individual processes {caa 
be identified] ; 

5 b) a validation [can b e performed] A by automatically verifying an interplay 

of {the} functionalities in accordance with an input to {the} said 
complete process, [to the effect] in a manner such that each of said 
individual [proc e ss] processes is not impeded during {the} an 
operation; and 

10 c) data from a result of {the} said validation [can b e ] that is used for 

controlling {the} said complete process. 
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This rediined draft, generated by CompareRite (TM) - The Instant Redliner, shows 
the differences between - 

original document : Q:\DOCUMENTS\YEAR 2000\P001982-BRANDIN-\ORIGINAL 
SPECIFICATION.DOC 
5 and revised document: Q:\DOCUMENTS\YEAR 2000VP001982-BRANDIN- 
\SUBSTITUTE SPECIFICATION.DOC 

CompareRite found 124 change(s) in the text 

i o Deletions appear as Overstrike text surrounded by [] 
Additions appear as Bold-Underline text 

[Description! SPECIFICATION 
TM e thod and arrang e ment for d e signing th e control of a compl e t e process] TITLE 
is METHOD AND ARRANGEMENT FOR DESIGNING THE CONTROL OF A 

COMPLETE PROCESS 
BACKGROUND OF THE INVENTION 

Field of the Invention 

20 The invention relates to a method and an arrangement for designing the 

control of a complete process which comprises a number of individual processes. 

Description of the Related Art 

The control of a complex technical installation or [, r es pectiv e ly,] of a system 
25 {{}(a complete process) comprises a number of smaller control units which are 

provided for certain parts (individual processes) of the installation or [, r e sp e ctiv e ly,] 
of the system. A first control unit for a first individual process is restricted in this case 
to this individual process. The same applies to a second control for a second 
individual process. Even if an interplay of the first control with the second control 
30 functions largely without errors, this does not guarantee that an error-free operation 
of the complete installation is still guaranteed with a slight modification of the first or 
of the second individual process. Thus, a small change in f a proc e ss] one of these 
processes or the addition of a third process can lead to conflicts and blocking 
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between the processes which can only be empirically verified. In this context, it is 
possible that a faulty state of the complete process overcomes an empirical test and 
thus remains undetected. This is not acceptable A especially with regard to a critical 
installation with respect to safety since it must be guaranteed in every case that no 
5 unpredicted event occurs in the interplay of the processes. 

Apart from the unauthorized states to be avoided, there are* in the sequence 
of a process [so - call e d authorized states] , "authorized states" which should occur 
exclusively for the process if it is functioning correctly. 

10 SUMMARY OF THE INVENTION 

It is the object of the invention to specify a method and an arrangement for 
designing the control of a complete process in which it is (formally) ensured that 
there is no impediment to the individual processes and that only authorized states 
are occupied. 

is This object is achieved [in accordanc e with th e featur es of the ind e p e ndent 

Glaimsrl by a method for designing a control of a complete process which 
comprises a number of individual processes, the method comprising the steps 
of: identifying functionalities of the individual processes; performing a 
validation by automatically verifying an interplay of the functionalities in 

20 accordance with an input to the complete process, while not impeding each 
individual process during an operation, producing a validation result; and 
determining data for controlling the complete process from the validation 
result. 

[Within th e cont e xt of the inv e nt i on,] This object is also achieved by an 
25 arrangement for designing the control of a complete process, comprising a 
number of individual processes; and a processor unit configured to provide: a) 
identification of functionalities of the individual processes; b) a validation, by 
automatically verifying an interplay of functionalities in accordance with an 
input to the complete process, in a manner such that each of the individual 
30 processes is not impeded during an operation; and c) data from a result of the 
validation that is used for controlling the complete process. 

Further developments of the invention include providing a method step 

— 2 — 
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of performing a sequence optimization. A step of producing data for the 
control in an executable code form may be provided, as may a step of 
controlling individual affected processes by a software unit which is one of the 
functionalities of the individual processes. One or more of the individual 
5 processes may be an impeding process, an impeding process being defined 
as such if one of the following conditions is met: an individual process is 
blocked by another individual process; and an individual process reaches an 
unauthorized state or a state endangering operation of the complete system. 
The inventive method may be applied to controlling individual processes of an 
10 automatic placement machine, and may also involve controlling a technical 
installation with data determined for controlling the complete process. 

In more detail, the invention relates to a method for designing the control of 
a complete process which comprises a number of individual processes [i s sp e cifi e d] . 

□ In the method, functionalities of the individual processes are identified. Furthermore, 
;1 isa validation is performed by automatically verifying an interplay of the functionalities 
°y in accordance with an input to the complete process, to the effect that each 

3 individual process is not disturbed during the operation. From the result of the 

;f validation, data for controlling the complete process are determined. 

An advantage of the method [consists in] is that [it is en s ur e d in] the step of 
; 20 validation ensures that each individual process can run undisturbed. A further 

□ advantage [consi s ts in th e automatic generation of d a t a l is that data is 

'fif automatically generated for controlling the complete process. Thus, data for 

M controlling the complete process are systematically generated with the aid of the 

method. 

25 An embodiment [consists] is provided in {that} which a sequence 

optimization is performed after the validation. [Thus, it is certainly an advant a ge th a t] 
Advantageously, individual processes can run undisturbed [and anoth e r a dv a ntag e 
consi s ts in that] ; furthermore, the several individual processes can run time- 
optimized if possible. It is the aim of the sequence optimization to carry out the 

30 performance of predetermined actions of the several individual processes in parallel 
and in the shortest possible time without disturbances. 

A further development [con s ists in] is that the data for controlling the complete 

--3 — 
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process are determined in the form of an executable code. This ensures that the 
result of the validation and possibly of the sequence optimization flows completely 
automatically into the control of the complete process. For example, a program code 
written in the programming [ l anguage C or th e programming language] languages C 

5 or C++ is generated which initiates or ensures the control of the complete process. 
In particular, the advantage becomes noticeable in the generation of 
executable code if functionalities of the individual processes are also provided in the 
form of respective program units. If a number of functionalities in each of a number 
of individual processes [ i n e ach] correspond to at least one program unit, the data 

10 which were generated in the form of executable codes are used for controlling the 
coordination of the individual program units or, respectively, the executable code 
uses the interfaces, e.g. x function calls or method calls, provided by the program 
units. 

It is also a further development that an individual process is disturbed if one of 

15 the following conditions is met: 

a) The individual process is blocked by another individual process. In the case of 
the blocking, two individual processes wish to use one physical resource in 
different ways. In such a case, blocking occurs since the resource cannot 
meet the requirements of both individual processes at the same time. 

20 b) The individual process reaches an unauthorized state or a state endangering 
the operation of the complete system. It is an essential requirement for a 
critical application with respect to safety that no hazardous states are 
assumed. 

[ I n th e cont e xt of th e ] The invention^ also provides an arrangement for 
25 controlling a complete process [is also sp e cifi e d, which complet e proc ess ] that 

comprises a number of individual processes, a processor unit being provided which 
is set up in such a manner that functionalities of the individual processes can be 
identified. Furthermore, a validation can be performed by automatically verifying an 
interplay of the functionalities in accordance with an input to the complete process to 
30 the effect that each individual process is not impeded during the operation. Finally, 
the data resulting from the result of the validation can be used for controlling the 
complete process. 

~ 4 — 
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This arrangement is particularly suitable !, in p a rticular,] for carrying out the 
method according to the invention or one of its further developments explained 
above. 

[Furth e r d e v el opm e nts of the i nvention ar e also obt a in e d from th e dep e ndent 
claims^ BRIEF DESCRIPTION OF THE DRAWINGS 

In the text which follows, exemplary embodiments of the invention are shown 
and explained with reference to the [drawing, in which:] drawings. 
[Fig. 1 shows] Fig. 1 8s a schematic diagram showing a turret head of an 

automatic placement machine; 
Fig. 2 [ s how s ] is a flowchart showing steps of a method for generating the control 

of a complete process; 
Fig. 3 [shows] is a state [mach i ne which r e pr ese nts] diagram showing the system 

behavior of the "scan" operation; 
Fig. 4 [ s hows] is a state [machin e which repr e sents] diagram showing the specific 

system behavior of the scan test; 
Fig. 5 [ s how s ] is a state [machin e which repr e s e nts] diagram showing a sequential 

processing of the vacuum test and of the scan test; 
Fig. 6 [ s hows] is a state diagram illustrating two state machines which represent a 

parallel processing of the vacuum test and of the scan test; 
Fig. 7 fshows a number of state mach i n e s which r e pr ese nt! are state diagrams 

showing a system behavior; 
Fig. 8 [ s hows] |s a state [machin e which r e pres e nts] diagram showing a specific 

system behavior (error recovery) ;& t 
[Fig. 9 s hows] Figs. 9A & B are two state [machin e s] diagrams which in each 

case [r e pr es ent] show specific system behavior for the vacuum test and the 

scan test; 

[Fig. 10 shows] Figs. 10A& B are parts of a state [mach i n e for] diagram 
showing the complete process. 

DESCRIPTION OF THE PREFERRED EMBODIMENTS 

Figure 1 shows an exemplary embodiment having a turret head 101 of an 
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automatic placement machine. The turret head 101 accepts components and places 
them at a predetermined target position. The turret head contains 12 vacuum 
pipettes 102 which are used as receptacle and placement tool. If the turret head 101 
is used for a prolonged period, wear occurs, and the vacuum pipettes become dirty 
s and worn. Accordingly, it is necessary to perform periodic tests in order to determine 
the state of the vacuum pipettes 102 and to exchange them, if necessary. Two 
different tests are performed by two different C programs. A vacuum test 103 is used 
for finding out whether the respective vacuum pipette 102 can still generate the 
intended vacuum; a scan test 104 indicates the extent to which the individual 
10 vacuum pipette 102 is subject to physical wear and whether it needs to be 
exchanged. For {the} subsequent observations, the scan test 104 and the { 
Jvacuum test 103 access one and the same resource: the rotation of the turret head 
101. 

The text which follows explains how the control of a complete process is 
15 determined, guaranteeing freedom from conflict and providing for the execution of 
the vacuum test 103 and the scan test 104 at the same time without the complete 
process being able to assume unpredicted states. For this purpose, the function calls 
of the [abov e m e ntion e d] previously mentioned C programs must be coordinated. 
Figure 2 shows steps of a method for generating the control of a complete 
20 process. 

In a step 201, functionalities of the individual processes are identified 
(structuring ) f. Furthe r mor e , 1 , as well as controllable and uncontrollable events {are 
identifi e d] . Controllable events are events which can be avoided by the control. 
Uncontrollable events are events which cannot be avoided, e.g.* output values of 
25 sensors or results of actions. Furthermore, sequences of events are identified which 
represent a possible physical system behavior. In addition, sequences of events are 
identified which represent a specific system behavior {task-related system behavior) 
under the influence of the control. 

The step of structuring 201 also comprises the representation of a state 
30 machine as shown in figure 3 for the "scan behavior". 

From an initial state 301 , a "scan" command places the machine into a state 
302 in which the vacuum pipette 102 is examined for wear. If the "scanning" is 

— 6— 
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concluded, the machine returns to state 301 . Similarly, the machine returns to { 
Jstate 301 from state 302 when an error occurs ffi(e.g„ error: the process of 
scanning indicates that the vacuum pipette 102 must be replaced). A "recover" 
command changes state 301 to a state 303 in which the machine returns to the 

s starting conditions (recovering). If the "recovering" process is ended, the machine 
jumps back into state 301 ("done recover"). 

The specific system behavior is also shown in the form of a state [mach i n e} 
machine/diagram . For this purpose, [figur e 4] Figure 4 shows a state machine 
which corresponds to the specific system behavior for the coordination of the events 

10 "turn", "done turn", "error turn", "scan", "done scan", "error scan", and "counter". 
Figure 4 shows a state machine which represents the specific system 
behavior of the scan test 1 04. An initial state 401 is changed to a state 402 by a 
"turn" command. If the turning of the turret head 101 is ended, the machine changes 
from state 402 to a state 403. If an error occurs during the turn ("error turn"), state 

is 402 changes to a state 407. From state 403, the "scan" command initiates a change 
to a state 404; when the scan test 1 04 is concluded, the machine changes from state 
404 to a state 405. Incrementing a counter changes state 405 to a state 406. A 
check is then made to determine whether the counter has already reached a {value 
42} particular value, e.g., 12 for a turret heat having 12 pipettes . If this is so, 

20 state 406 is changed to state 407; if the counter exhibits a smaller value than 1 2, 
state 406 changes to state 401. Various commands ensure that state 407 is kept: 
"recover", "done recover", "operator input", and "stop". A "repeat" command causes 
the process to be repeated in that state 407 is changed to state 401 . 

A next step 202 in figure 2 ensures a validation of the control of the complete 

25 process by automatically verifying characteristics of the complete process. Such 
characteristics are, in particular, a blocking or non-blocking characteristic and a 
controllability characteristic. If various individual processes are operating in parallel 
with one another and if these individual processes share one or more resources (in 
this case the turning of the turret head 101), freedom from blocking is ensured if the 

30 individual processes can perform their tasks right to the end without impeding each 
other by accessing common resources. In the exemplary embodiment shown, the 
individual process scan test 104 and the individual process vacuum test 103 jointly 
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use the resource "turning of the turret head 101". This could lead to mutual blocking 
if the control of the complete process does not [prev e nt this pr e v e nt a tiv e ^] avoid 
this in a preventative manner . 

Furthermore, the validation 202 is carried out in that a plausibility check of the 
5 structuring 201 of the complete process to be controlled is effected by observation or 
simulation of the system and of the specific system behavior in the form of a state 
machine. Finally, predetermined characteristics are automatically verified. One of 
these characteristics is { 

}"after an error has occurred in scan test 104 (the event "error scan" was indicated), 
10 the "recovery" operation (the event "recover") always starts". 

The validation 202, if it is not done completely and which formally verifies the 
undisturbed sequence of the individual processes, is repeated by branching back to 
step 201, the structuring of the functionalities of the individual processes. If the 
validation 202 is successful, code for controlling the complete process is 
is automatically generated (compare change to step 203 in [figur e ] Figure 2). 

During this process, during the automatic generation of the control of the 
complete process, controllable events are allocated, in particular, to the linked 
function calls within the individual processes and thus to the associated program 
code fragments. Uncontrollable events are allocated to corresponding return values 
20 of function calls or output values of sensors. An example is represented by the 
function call of the event "scan" which relates to the corresponding program code 
fragment (C program routine "scan test") which comprises "scan error" or "scan 
done" as return values. 

The automatic generation of the C code for controlling the complete process 
25 is determined from various state machines, allocations and/or program code 
fragments. The individual functionalities structured in step 201 correspond in this 
case to the corresponding state machines or, respectively, program code fragments. 

As already mentioned, the vacuum test 103 and the scan test 104 are carried 
out in parallel, each test being performed at different physical locations (compare 
30 [figur e ] Figure 1 , noting the oppositely located performance of the two tests). 

Figures 5 and 6 show the desired behavior of the individual processes for the 
vacuum test 103 and the scan test 104, [figur e ] Figure 5 showing a sequential 
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processing of the two tests and [figure] Figure 6 showing a parallel processing of the 
two tests. In the parallel processing in [figur e ] Figure 6, blocking of the two 
individual processes can occur due to the fact that after the event "recovery 
vacuum", one of the two events "turn" or "counter" will not occur. As a result, a 
turning ("turn" command) of the cylinder head, which is needed by both individual 
processes running in parallel, is not guaranteed. [Wh e reas on e ] One machine wants 
to turn the cylinder head, but the other machine { 

Jwants to increment the counter, resulting in blocking. In contrast, sequential 
processing as indicated in [figur e ] Figure 5 is possible, but the tests for 12 vacuum 
pipettes 102 each being performed in succession fend thu s ] results in the cylinder 
head 101 having to be turned twice completely. The time expenditure for the 
sequential processing is far greater than for (almost) parallel processing. 

On the basis of [figur e ] Figure 4, [figure] Figure 5 to [figur e 1 0] Figure 10 can 
be analogously understood [p e r se . Thu s , figur e ] . Figure 5 comprises states 501 to 
517, figure 6 comprises states 601 to 618, states 501 to 509 and 509 to 517 
characterizing {the} in each case the independent machines according to [figur e ] 
Figure 6 which can run in parallel. The event which is in each case decisive for a 
state changing to another one is in each case indicated along the transition arrows in 
the figures. 

Events having the same name occur synchronously in machines in which the 
respective event is defined. In the present exemplary embodiment, the event "scan" 
occurs if the state machine of the system behavior (compare [figure] Figure 7) is in 
state "0" or, respectively, the state machine of the specific system behavior 
according to [figur e ] Figure 8 is in state 0 or in state 1 and if the state machine of the 
specific system behavior according to figure 9 is in state 2. 

Controllable events are: { 
}"turn", "scan", "vacuum", "recover", "recovery turn", "recovery scan", "recovery 
vacuum", "counter", "operator input", and "reset". { 
}Uncontrollable events are: { 

}"done turn", "error turn", "done scan", "error scan", "done vacuum", "error vacuum", 
"done recover, "counter=12?", "counter<12?", "stop", and "repeat". 

The respective state machine indicates the state in which the corresponding 
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system behavior can be terminated, i.e.* the state with a dark background defines a 
termination condition. 

Figure 7 shows [th e system b e havior. As alr e ady m e ntioned above, th e 
sy s tem b e havior s how s ] as sequences of events which represent physically possible 
5 system states. Such physically possible behaviors are the turning of the cylinder 
head, the performance of the vacuum test, the performance of the scan test, the 
incrementing and interrogating of the counter and the inputting of a command which 
triggers a predetermined action. The state 0 in fftewfr[ Figure 7 characterizes both 
the initial state and the end state of the respective system behavior. 

10 After the system behavior has been identified, the specific system behavior is 

determined which relates to a behavior of the complete process with regard to the 
task to be controlled. The associated state machine for the specific system behavior 
of the error recovery is shown in [figur e ] Figure 8. In [figur e ] Figure 8, there are Iwo 
marked states 801 and 807, state 801 being simultaneously the start and an end 

15 state of the state machine. The specific system behavior "error recovery" can be 
terminated in each case in states 801 and 807. 

According to the above statements, the validation is then performed. To this 
end, a number of iterations which, finally, lead to the solution according to [figure] 
Figure 7 to [figur e ] Figure 9 are shown according to [figure] Figure 2 (compare 

20 transition from validation 202 to structuring 201 : iteration). 

Figures 8 and 9 show the controlled specific system behavior corresponding 
to the predetermined functionality of the complete process. For this purpose, three 
tasks have been identified { 

}which are executed in parallel: error recovery, scan test x and vacuum test. The 
25 error recovery, in particular, is only activated if both the scan test 104 and the 
vacuum test 103 [[lacuna]] occur in a marked state (compare state 6 {©fv 
r es p e ctiv e ly] in Figure 8 or states 907, 917 in [figur e 9)] Figures 9A & B 
respectively) . The scan test 104 and the vacuum test 103 are only activated if the 
error recovery is in the initial state (compare state 0 or 801 in [figure] Figure 8). 
30 The system behavior and the specific system behavior according to [figur e s] 

Figures 7-9 are non-blocking. Furthermore, the specific system behavior according 
to [figur es ] Figures 8 and 9 is controllable with respect to the system behavior from 
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[figure 7.1 Figure 7. 

[In figure 10] In Figures 10A & B (collectively, Figure 10) . the complete 
process is assembled from the state machines according to [figur es ] Figures 7-9. 
Figure 10 represents the product state machine of the state machines described 
[and is comprehensib le per s e ] above . In particular, the product state machine 
according to [figur e ] Figure 10 is not used for structuring and solving the control task 
for the complete process since the easily traceable procedure, as described, 
guarantees a structured and clear approach to determining the data which are 
necessary for controlling the complete process. 

The executable program code for controlling the complete process is 
automatically generated in that first function calls are assigned to the controllable 
events, the return values of the function calls or output values of sensors being 
assigned the corresponding uncontrollable events. The program code for controlling 
the complete process is generated from the state machine assignments and 
associated program code fragments. 

[Ab s tract] The above-described method and arrangement are illustrative 
of the principles of the present invention. Numerous modifications and 
adaptations thereof will be readily apparent to those skilled in this art without 
departing from the spirit and scope of the present invention. 
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[M e thod and arrang e m e nt for d es i gnin g t he control of a compl e t e proc e s s ] 
ABSTRACT 

To prevent blocking between competing individual processes within a 
complete process, functionalities of the individual processes are identified and the 
[int e rplay] interplay/interaction of these functionalities is validated. The data 
obtained from the validation can be used for controlling the complete process. 
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SPECIFICATION 
TITLE 

METHOD AND ARRANGEMENT FOR DESIGNING THE CONTROL OF A 

COMPLETE PROCESS 
5 BACKGROUND OF THE INVENTION 

Field of the Invention 

The invention relates to a method and an arrangement for designing the 
control of a complete process which comprises a number of individual processes. 

10 

Description of the Related Art 

The control of a complex technical installation or of a system (a complete 
process) comprises a number of smaller control units which are provided for certain 
parts (individual processes) of the installation or of the system. A first control unit for 

15 a first individual process is restricted in this case to this individual process. The 
same applies to a second control for a second individual process. Even if an 
interplay of the first control with the second control functions largely without errors, 
this does not guarantee that an error-free operation of the complete installation is 
still guaranteed with a slight modification of the first or of the second individual 

20 process. Thus, a small change in one of these processes or the addition of a third 
process can lead to conflicts and blocking between the processes which can only be 
empirically verified. In this context, it is possible that a faulty state of the complete 
process overcomes an empirical test and thus remains undetected. This is not 
acceptable, especially with regard to a critical installation with respect to safety since 

25 it must be guaranteed in every case that no unpredicted event occurs in the interplay 
of the processes. 

Apart from the unauthorized states to be avoided, there are, in the sequence 
of a process, "authorized states" which should occur exclusively for the process if it 
is functioning correctly. 

30 
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SUMMARY OF THE INVENTION 

It is the object of the invention to specify a method and an arrangement for 
designing the control of a complete process in which it is (formally) ensured that 
there is no impediment to the individual processes and that only authorized states 
5 are occupied. 

This object is achieved by a method for designing a control of a complete 
process which comprises a number of individual processes, the method comprising 
the steps of: identifying functionalities of the individual processes; performing a 
validation by automatically verifying an interplay of the functionalities in accordance 

10 with an input to the complete process, while not impeding each individual process 
during an operation, producing a validation result; and determining data for 
controlling the complete process from the validation result. 

This object is also achieved by an arrangement for designing the control of a 
complete process, comprising a number of individual processes; and a processor 

1 5 unit configured to provide: a) identification of functionalities of the individual 

processes; b) a validation, by automatically verifying an interplay of functionalities in 
accordance with an input to the complete process, in a manner such that each of the 
individual processes is not impeded during an operation; and c) data from a result of 
the validation that is used for controlling the complete process. 

20 Further developments of the invention include providing a method step of 

performing a sequence optimization. A step of producing data for the control in an 
executable code form may be provided, as may a step of controlling individual 
affected processes by a software unit which is one of the functionalities of the 
individual processes. One or more of the individual processes may be an impeding 

25 process, an impeding process being defined as such if one of the following 

conditions is met: an individual process is blocked by another individual process; 
and an individual process reaches an unauthorized state or a state endangering 
operation of the complete system. The inventive method may be applied to 
controlling individual processes of an automatic placement machine, and may also 
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involve controlling a technical installation with data determined for controlling the 
complete process. 

In more detail, the invention relates to a method for designing the control of a 
complete process which comprises a number of individual processes. In the method, 
5 functionalities of the individual processes are identified. Furthermore, a validation is 
performed by automatically verifying an interplay of the functionalities in accordance 
with an input to the complete process, to the effect that each individual process is 
not disturbed during the operation. From the result of the validation, data for 
controlling the complete process are determined. 
10 An advantage of the method is that the step of validation ensures that each 

individual process can run undisturbed. A further advantage is that data is 
automatically generated for controlling the complete process. Thus, data for 
, controlling the complete process are systematically generated with the aid of the 
;fl method. 

fU 15 An embodiment is provided in which a sequence optimization is performed 

?*j after the validation. Advantageously, individual processes can run undisturbed; 

2 furthermore, the several individual processes can run time-optimized if possible. It is 

; S the aim of the sequence optimization to carry out the performance of predetermined 

J ^ actions of the several individual processes in parallel and in the shortest possible 

□ 20 time without disturbances. 

g A further development is that the data for controlling the complete process are 

determined in the form of an executable code. This ensures that the result of the 
validation and possibly of the sequence optimization flows completely automatically 
into the control of the complete process. For example, a program code written in the 

25 programming languages C or C++ is generated which initiates or ensures the control 
of the complete process. 

In particular, the advantage becomes noticeable in the generation of 
executable code if functionalities of the individual processes are also provided in the 
form of respective program units. If a number of functionalities in each of a number 

30 of individual processes correspond to at least one program unit, the data which were 
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generated in the form of executable codes are used for controlling the coordination 
of the individual program units or, respectively, the executable code uses the 
interfaces, e.g., function calls or method calls, provided by the program units. 

It is also a further development that an individual process is disturbed if one of 
5 the following conditions is met: 

a) The individual process is blocked by another individual process. In the case of 
the blocking, two individual processes wish to use one physical resource in 
different ways. In such a case, blocking occurs since the resource cannot 
meet the requirements of both individual processes at the same time. 
10 b) The individual process reaches an unauthorized state or a state endangering 
the operation of the complete system. It is an essential requirement for a 
critical application with respect to safety that no hazardous states are 
assumed. 

The invention also provides an arrangement for controlling a complete 
15 process that comprises a number of individual processes, a processor unit being 
provided which is set up in such a manner that functionalities of the individual 
processes can be identified. Furthermore, a validation can be performed by 
automatically verifying an interplay of the functionalities in accordance with an input 
to the complete process to the effect that each individual process is not impeded 
20 during the operation. Finally, the data resulting from the result of the validation can 
be used for controlling the complete process. 

This arrangement is particularly suitable for carrying out the method 
according to the invention or one of its further developments explained above. 

25 BRIEF DESCRIPTION OF THE DRAWINGS 

In the text which follows, exemplary embodiments of the invention are shown 
and explained with reference to the drawings. 

Fig. 1 is a schematic diagram showing a turret head of an automatic placement 
machine; 
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Fig. 2 is a flowchart showing steps of a method for generating the control of a 
complete process; 

Fig. 3 is a state diagram showing the system behavior of the "scan" operation; 
Fig. 4 is a state diagram showing the specific system behavior of the scan test; 
5 Fig. 5 is a state diagram showing a sequential processing of the vacuum test and of 
the scan test; 

Fig. 6 is a state diagram illustrating two state machines which represent a parallel 

processing of the vacuum test and of the scan test; 
Fig. 7 are state diagrams showing a system behavior; 
10 Fig. 8 is a state diagram showing a specific system behavior (error recovery); 
Figs. 9A & B are two state diagrams which in each case show specific system 

behavior for the vacuum test and the scan test; 
Figs. 10A & B are parts of a state diagram showing the complete process. 

15 DESCRIPTION OF THE PREFERRED EMBODIMENTS 

Figure 1 shows an exemplary embodiment having a turret head 101 of an 
automatic placement machine. The turret head 101 accepts components and places 
them at a predetermined target position. The turret head contains 12 vacuum 
pipettes 102 which are used as receptacle and placement tool. If the turret head 101 

20 is used for a prolonged period, wear occurs, and the vacuum pipettes become dirty 
and worn. Accordingly, it is necessary to perform periodic tests in order to determine 
the state of the vacuum pipettes 102 and to exchange them, if necessary. Two 
different tests are performed by two different C programs. A vacuum test 103 is used 
for finding out whether the respective vacuum pipette 102 can still generate the 

25 intended vacuum; a scan test 104 indicates the extent to which the individual 
vacuum pipette 102 is subject to physical wear and whether it needs to be 
exchanged. For subsequent observations, the scan test 104 and the vacuum test 
103 access one and the same resource: the rotation of the turret head 101. 

The text which follows explains how the control of a complete process is 

30 determined, guaranteeing freedom from conflict and providing for the execution of 



— 5 — 



SUBSTITUTE SPECIFICATION 



the vacuum test 1 03 and the scan test 104 at the same time without the complete 
process being able to assume unpredicted states. For this purpose, the function 
calls of the previously mentioned C programs must be coordinated. 

Figure 2 shows steps of a method for generating the control of a complete 
5 process. 

In a step 201, functionalities of the individual processes are identified 
(structuring), as well as controllable and uncontrollable events. Controllable events 
are events which can be avoided by the control. Uncontrollable events are events 
which cannot be avoided, e.g., output values of sensors or results of actions. 
10 Furthermore, sequences of events are identified which represent a possible physical 
system behavior. In addition, sequences of events are identified which represent a 
specific system behavior (task-related system behavior) under the influence of the 
r-% control. 

^ The step of structuring 201 also comprises the representation of a state 

rtj 15 machine as shown in figure 3 for the "scan behavior". 

P3 From an initial state 301 , a "scan" command places the machine into a state 

;3 302 in which the vacuum pipette 102 is examined for wear. If the "scanning" is 

concluded, the machine returns to state 301 . Similarly, the machine returns to state 

2 301 from state 302 when an error occurs (e.g., error: the process of scanning 
O 20 indicates that the vacuum pipette 102 must be replaced). A "recover" command 

3 changes state 301 to a state 303 in which the machine returns to the starting 
conditions (recovering). If the "recovering" process is ended, the machine jumps 
back into state 301 ("done recover"). 

The specific system behavior is also shown in the form of a state 
2 5 machine/diagram. For this purpose, Figure 4 shows a state machine which 

corresponds to the specific system behavior for the coordination of the events "turn", 
"done turn", "error turn", "scan", "done scan", "error scan", and "counter". 

Figure 4 shows a state machine which represents the specific system 
behavior of the scan test 1 04. An initial state 401 is changed to a state 402 by a 
30 "turn" command. If the turning of the turret head 101 is ended, the machine changes 
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from state 402 to a state 403. If an error occurs during the turn ("error turn"), state 
402 changes to a state 407. From state 403, the "scan" command initiates a change 
to a state 404; when the scan test 104 is concluded, the machine changes from 
state 404 to a state 405. Incrementing a counter changes state 405 to a state 406. A 
5 check is then made to determine whether the counter has already reached a 

particular value, e.g., 12 for a turret heat having 12 pipettes. If this is so, state 406 is 
changed to state 407; if the counter exhibits a smaller value than 12, state 406 
changes to state 401 . Various commands ensure that state 407 is kept: "recover", 
"done recover", "operator input", and "stop". A "repeat" command causes the 

10 process to be repeated in that state 407 is changed to state 401 . 

A next step 202 in figure 2 ensures a validation of the control of the complete 
process by automatically verifying characteristics of the complete process. Such 
characteristics are, in particular, a blocking or non-blocking characteristic and a 
controllability characteristic. If various individual processes are operating in parallel 

15 with one another and if these individual processes share one or more resources (in 
this case the turning of the turret head 101), freedom from blocking is ensured if the 
individual processes can perform their tasks right to the end without impeding each 
other by accessing common resources. In the exemplary embodiment shown, the 
individual process scan test 104 and the individual process vacuum test 103 jointly 

2 0 use the resource "turning of the turret head 101". This could lead to mutual blocking 
if the control of the complete process does not avoid this in a preventative manner. 

Furthermore, the validation 202 is carried out in that a plausibility check of the 
structuring 201 of the complete process to be controlled is effected by observation or 
simulation of the system and of the specific system behavior in the form of a state 

25 machine. Finally, predetermined characteristics are automatically verified. One of 
these characteristics is "after an error has occurred in scan test 104 (the event "error 
scan" was indicated), the "recovery" operation (the event "recover") always starts". 

The validation 202, if it is not done completely and which formally verifies the 
undisturbed sequence of the individual processes, is repeated by branching back to 

30 step 201 , the structuring of the functionalities of the individual processes. If the 
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validation 202 is successful, code for controlling the complete process is 
automatically generated (compare change to step 203 in Figure 2). 

During this process, during the automatic generation of the control of the 
complete process, controllable events are allocated, in particular, to the linked 
function calls within the individual processes and thus to the associated program 
code fragments. Uncontrollable events are allocated to corresponding return values 
of function calls or output values of sensors. An example is represented by the 
function call of the event "scan" which relates to the corresponding program code 
fragment (C program routine "scan test") which comprises "scan error" or "scan 
done" as return values. 

The automatic generation of the C code for controlling the complete process 
is determined from various state machines, allocations and/or program code 
fragments. The individual functionalities structured in step 201 correspond in this 
case to the corresponding state machines or, respectively, program code fragments. 

As already mentioned, the vacuum test 103 and the scan test 104 are carried 
out in parallel, each test being performed at different physical locations (compare 
Figure 1, noting the oppositely located performance of the two tests). 

Figures 5 and 6 show the desired behavior of the individual processes for the 
vacuum test 103 and the scan test 104, Figure 5 showing a sequential processing of 
the two tests and Figure 6 showing a parallel processing of the two tests. In the 
parallel processing in Figure 6, blocking of the two individual processes can occur 
due to the fact that after the event "recovery vacuum", one of the two events "turn" or 
"counter" will not occur. As a result, a turning ("turn" command) of the cylinder head, 
which is needed by both individual processes running in parallel, is not guaranteed. 
One machine wants to turn the cylinder head, but the other machine wants to 
increment the counter, resulting in blocking. In contrast, sequential processing as 
indicated in Figure 5 is possible, but the tests for 12 vacuum pipettes 102 each 
being performed in succession results in the cylinder head 101 having to be turned 
twice completely. The time expenditure for the sequential processing is far greater 
than for (almost) parallel processing. 
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On the basis of Figure 4, Figure 5 to Figure 10 can be analogously 
understood. Figure 5 comprises states 501 to 517, figure 6 comprises states 601 to 
618, states 501 to 509 and 509 to 517 characterizing in each case the independent 
machines according to Figure 6 which can run in parallel. The event which is in each 
case decisive for a state changing to another one is in each case indicated along the 
transition arrows in the figures. 

Events having the same name occur synchronously in machines in which the 
respective event is defined. In the present exemplary embodiment, the event "scan" 
occurs if the state machine of the system behavior (compare Figure 7) is in state "0" 
or, respectively, the state machine of the specific system behavior according to 
Figure 8 is in state 0 or in state 1 and if the state machine of the specific system 
behavior according to figure 9 is in state 2. 

Controllable events are: "turn", "scan", "vacuum", "recover, "recovery turn", 
"recovery scan", "recovery vacuum", "counter, "operator input", and "reset". 
Uncontrollable events are: "done turn", "error turn", "done scan", "error scan", "done 
vacuum", "error vacuum", "done recover, "counter=1 2?", "counter<1 2?", "stop", and 
"repeat". 

The respective state machine indicates the state in which the corresponding 
system behavior can be terminated, i.e., the state with a dark background defines a 
termination condition. 

Figure 7 shows as sequences of events which represent physically possible 
system states. Such physically possible behaviors are the turning of the cylinder 
head, the performance of the vacuum test, the performance of the scan test, the 
incrementing and interrogating of the counter and the inputting of a command which 
triggers a predetermined action. The state 0 in Figure 7 characterizes both the initial 
state and the end state of the respective system behavior. 

After the system behavior has been identified, the specific system behavior is 
determined which relates to a behavior of the complete process with regard to the 
task to be controlled. The associated state machine for the specific system behavior 
of the error recovery is shown in Figure 8. In Figure 8, there are two marked states 
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801 and 807, state 801 being simultaneously the start and an end state of the state 
machine. The specific system behavior "error recovery" can be terminated in each 
case in states 801 and 807. 

According to the above statements, the validation is then performed. To this 
5 end, a number of iterations which, finally, lead to the solution according to Figure 7 
to Figure 9 are shown according to Figure 2 (compare transition from validation 202 
to structuring 201: iteration). 

Figures 8 and 9 show the controlled specific system behavior corresponding 
to the predetermined functionality of the complete process. For this purpose, three 
10 tasks have been identified which are executed in parallel: error recovery, scan test, 
and vacuum test. The error recovery, in particular, is only activated if both the scan 
test 104 and the vacuum test 103 occur in a marked state (compare state 6 in Figure 
3 8 or states 907, 917 in Figures 9A & B respectively). The scan test 104 and the 

1 vacuum test 1 03 are only activated if the error recovery is in the initial state 

-J 15 (compare state 0 or 801 in Figure 8). 

□ The system behavior and the specific system behavior according to Figures 

i 7-9 are non-blocking. Furthermore, the specific system behavior according to 

; Figures 8 and 9 is controllable with respect to the system behavior from Figure 7. 

^ In Figures 10A & B (collectively, Figure 10), the complete process is 

a ™ 2 0 assembled from the state machines according to Figures 7-9. Figure 10 represents 
3 the product state machine of the state machines described above. In particular, the 

:: :e£; 

product state machine according to Figure 10 is not used for structuring and solving 
the control task for the complete process since the easily traceable procedure, as 
described, guarantees a structured and clear approach to determining the data 
25 which are necessary for controlling the complete process. 

The executable program code for controlling the complete process is 
automatically generated in that first function calls are assigned to the controllable 
events, the return values of the function calls or output values of sensors being 
assigned the corresponding uncontrollable events. The program code for controlling 
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the complete process is generated from the state machine assignments and 
associated program code fragments. 

The above-described method and arrangement are illustrative of the 
principles of the present invention. Numerous modifications and adaptations thereof 
will be readily apparent to those skilled in this art without departing from the spirit 
and scope of the present invention. 
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ABSTRACT 

To prevent blocking between competing individual processes within a 
complete process, functionalities of the individual processes are identified and the 
interplay/interaction of these functionalities is validated. The data obtained from the 
validation can be used for controlling the complete process. 
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Method and arrangement for designing the control of a 
complete process 

5 

The invention relates to a method and an 
arrangement for designing the control of a complete 
process which comprises a number of individual 
processes . 

10 The control of a complex technical installation 

or, respectively, of a system (complete process) 
comprises a number of smaller control units which are 
provided for certain parts (individual processes) of 
the installation or, respectively, of the system. A 

15 first control unit for a first individual process is 
restricted in this case to this individual process. The 
same applies to a second control for a second 
individual process. Even if an interplay of the first 
control with the second control functions largely 

20 without errors, this does not guarantee that an error- 
free operation of the complete installation is still 
guaranteed with a slight modification of the first or 
of the second individual process. Thus, a small change 
in a process or the addition of a third process can 

25 lead to conflicts and blocking between the processes 
which can only be empirically verified. In this 
context, it is possible that a faulty state of the 
complete process overcomes an empirical test and thus 
remains undetected. This is not acceptable especially 

30 with regard to a critical installation with respect to 
safety since it must be guaranteed in every case that 
no unpredicted event occurs in the interplay of the 
processes . 

Apart from the unauthorized states to be 
35 avoided, there are in the sequence of a process so- 
called authorized states which should occur exclusively 
for the process if it is functioning correctly. 
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It is the object of the invention to specify a 
method and an arrangement for designing the control of 
a complete process in which it is (formally) ensured 
that there is no impediment to the individual processes 
5 and only authorized states are occupied. 

This object is achieved in accordance with the 
features of the independent claims. 

Within the context of the invention , a method 
for designing the control of a complete process which 
10 comprises a number of individual processes is 
specified. In the method, functionalities of the 
individual processes are identified. Furthermore, a 
validation is performed by automatically verifying an 
interplay of the functionalities in accordance with an 
15 input to the complete process, to the effect that each 

: !:saT* 

HO individual process is not disturbed during the 

^ operation. From the result of the validation, data for 

| SS fe controlling the complete process are determined. 

."SR. 

y An advantage of the method consists in that it 

20 is ensured in the step of validation that each 
- individual process can run undisturbed. A further 

^ advantage consists in the automatic generation of data 

for controlling the complete process. Thus, data for 
Ld controlling the complete process are systematically 

25 generated with the aid of the method. 

An embodiment consists in that a sequence 
optimization is performed after the validation. Thus, 
it is certainly an advantage that individual processes 
can run undisturbed and another advantage consists in 
30 that the several individual processes run time- 
optimized if possible. It is the aim of the sequence 
optimization to carry out the performance of 
predetermined actions of the several individual 
processes in parallel and in the shortest possible time 
35 without disturbances. 
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A further development consists in that the data 
for controlling the complete process are determined in 
the form of an executable code. This ensures that the 
result of the validation and possibly of the sequence 
5 optimization flows completely automatically into the 
control of the complete process. For example, a program 
code written in the programming language C or the 
programming language C++ is generated which initiates 
or ensures the control of the complete process. 

10 In particular, the advantage becomes noticeable 

in the generation of executable code if functionalities 
of the individual processes are also provided in the 
form of respective program units. If a number of 
functionalities of a number of individual processes in 

15 each correspond to at least one program unit, the data 
which were generated in the form of executable codes 
are used for controlling the coordination of the 
individual program units or, respectively, the 
executable code uses the interfaces, e.g. function 

20 calls or method calls, provided by the program units. 

It is also a further development that an 
individual process is disturbed if one of the following 
conditions is met: 

a) The individual process is blocked by another 
25 individual process. In the case of the blocking, 

two individual processes wish to use one physical 
resource in ' different ways. In such a case, 
blocking occurs since the resource cannot meet the 
requirements of both individual processes at the 
30 same time. 

b) The individual process reaches an unauthorized 
state or a state endangering the operation of the 
complete system. It is an essential requirement 
for a critical application with respect to safety 

35 that no hazardous states are assumed. 
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In the context of the invention, an arrangement 
for controlling a complete process is also specified, 
which complete process comprises a number of individual 
processes, a processor unit being provided which is set 
5 up in such a manner that functionalities of the 
individual processes can be identified. Furthermore, a 
validation can be performed by automatically verifying 
an interplay of the functionalities in accordance with 
an input to the complete process to the effect that 
10 each individual process is not impeded during the 
operation. Finally, the data resulting from the result 
of the validation can be used for controlling the 
complete process. 

This arrangement is suitable, in particular, 
Q 15 for carrying out the method according to the invention 

'"*13 or one of its further developments explained above. 

Further developments of the invention are also 
M obtained from the dependent claims. 

In the text which follows, exemplary 
iS 20 embodiments of the invention are shown and explained 

=-s with reference to the drawing, in which: 

H Fig. 1 ^shows a turret head of an automatic placement 

r ; i machine; 

UJ Fig. 2 shows steps of a method for generating the 

25 control of a complete process; 

Fig. 3 shows a state machine which represents the 

system behavior of the "scan" operation; 
Fig. 4 shows a state machine which represents the 
specific system behavior of the scan test; 



30 
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Fig. 5 shows a state machine which represents a 
sequential processing of the vacuum test and of 
the scan test; 

Fig, 6 shows two state machines which represent a 
5 parallel processing of the vacuum test and of 

the scan test; 

Fig. 7 shows a number of state machines which 

represent a system behavior; 
Fig. 8 shows a state machine which represents a 

10 specific system behavior; 

Fig. 9 shows two state machines which in each case 
represent specific system behavior for the 
vacuum test and the scan test; 
Fig. 10 shows a state machine for the complete process. 

15 Figure 1 shows a turret head 101 of an 

automatic placement machine. The turret head 101 
accepts components and places them at a predetermined 
target position. The turret head contains 12 vacuum 
pipettes 102 which are used as receptacle and placement 

20 tool. If the turret head 101 is used for a prolonged 
period, wear occurs, the vacuum pipettes become dirty 
and worn. Accordingly, it is necessary to perform 
periodic tests in order to determine the state of the 
vacuum pipettes 102 and to exchange them, if necessary. 

25 Two different tests are performed by two different C 
programs. A vacuum test 103 is used for finding out 
whether the respective vacuum pipette 102 can still 
generate the intended vacuum; a scan test 104 indicates 
the extent to which the individual vacuum pipette 102 

30 is subject to physical wear and whether it needs to be 
exchanged* For the subsequent observations, the scan 
test 104 and the 
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vacuum test 103 access one and the same resource: the 
rotation of the turret head 101. 

The text which follows explains how the control 
of a complete process is determined, guaranteeing 
5 freedom from conflict and providing for the execution 
of vacuum test 103 and scan test 104 at the same time 
without the complete process being able to assume 
unpredicted states. For this purpose, the function 
calls of the abovementioned C programs must be 
10 coordinated. 

Figure 2 shows steps of a method for generating 
the control of a complete process* 

In a step 201, functionalities of the 
individual processes are identified (structuring) . 
O 15 Furthermore, controllable and uncontrollable events are 

identified. Controllable events are events which can be 

""••aA 

v(i avoided by the control. Uncontrollable events are 

H 5 events which cannot be avoided, e.g. output values of 

% sensors or results of actions. Furthermore, sequences 

g 20 of events are identified which represent a possible 

" physical system behavior. In addition, sequences of 

TT; events are identified which represent a specific system 

p behavior (task-related system behavior) under the 

influence of the control. 
'H 25 The step of structuring 201 also comprises the 

representation of a state machine as shown in figure 3 

for the "scan behavior". 

From an initial state 301, a "scan" command 

places the machine into a state 302 in which the vacuum 
30 pipette 102 is examined for wear. If the "scanning" is 

concluded, the machine returns to state 301. Similarly, 

the machine returns to 
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state 301 from state 302 when an error occurs (error: 
the process of scanning indicates that the vacuum 
pipette 102 must be replaced) . A "recover" command 
changes state 301 to a state 303 in which the machine 
returns to the starting conditions (recovering) . If the 
"recovering" process is ended, the machine jumps back 
into state 301 ("done recover") . 

The specific system behavior is also shown in 
the form of a state machine. For this purpose, figure 4 
shows a state machine which corresponds to the specific 
system behavior for the coordination of the events 
"turn", "done turn", "error turn", "scan", "done scan", 
"error scan", "counter". 

Figure 4 shows a state machine which represents 
the specific system behavior of the scan test 104. An 
initial state 401 is changed to a state 402 by a "turn" 
command. If the turning of the turret head 101 is 
ended, the machine changes from state 402 to a state 
403. If an error occurs during the turn ("error turn"), 
state 402 changes to a state 407. From state 403, the 
"scan" command initiates a change to a state 404; when 
the scan test 104 is concluded, the machine changes 
from state 404 to a state 405. Incrementing a counter 
changes state 405 to a state 406. A check is then made 
to determine whether the counter has already reached a 
value 12. If this is so, state 406 is changed to state 
407; if the counter exhibits a smaller value than 12, 
state 406 changes to state 401. Various commands ensure 
that state 407 is kept: "recover", "done recover", 
"operator input", "stop". A "repeat" command causes the 
process to be repeated in that state 407 is changed to 
state 401. 
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A next step 202 in figure 2 ensures a 
validation of the control of the complete process by 
automatically verifying characteristics of the complete 
process. Such characteristics are, in particular, a 
blocking or non-blocking characteristic and a 
controllability characteristic. If various individual 
processes are operating in parallel with one another 
and if these individual processes share one or more 
resources (in this case the turning of the turret head 
101), freedom from blocking is ensured if the 
individual processes can perform their tasks right to 
the end without impeding each other by accessing common 
resources. In the exemplary embodiment shown, the 
individual process scan test 104 and the individual 
process vacuum test 103 jointly use the resource 
"turning of the turret head 101". This could lead to 
mutual blocking if the control of the complete process 
does not prevent this preventatively . 

Furthermore, the validation 202 is carried out 
in that a plausibility check of the structuring 201 of 
the complete process to be controlled is effected by 
observation or simulation of the system and of the 
specific system behavior in the form of a state 
machine. Finally , predetermined characteristics are 
automatically verified. One of these characteristics is 
"after an error has occurred in scan test 104 (the 
event "error scan" was indicated) , the "recovery" 
operation (the event "recover") always starts". 

The validation 202, if it is not done 
completely and which formally verifies the undisturbed 
sequence of the individual processes, is repeated by 
branching back to step 201, the structuring of the 
functionalities of the individual processes. If the 
validation 202 is successful, code for controlling the 
complete process is automatically generated (compare 
change to step 203 in figure 2) . 
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During this process, during the automatic 
generation of the control of the complete process, 
controllable events are allocated, in particular, to 
the linked function calls within the individual 
processes and thus to the associated program code 
fragments. Uncontrollable events are allocated to 
corresponding return values of function calls or output 
values of sensors. An example is represented by the 
function call of the event "scan" which relates to the 
corresponding program code fragment (C program routine 
"scan test") which comprises "scan error" or "scan 
done" as return values. 

The automatic generation of the C code for 
controlling the complete process is determined from 
various state machines, allocations and/or program code 
fragments. The individual functionalities structured in 
step 201 correspond in this case to the corresponding 
state machines or, respectively, program code 
fragments . 

As already mentioned, the vacuum test 103 and 
the scan test 104 are carried out in parallel, each 
test being performed at different physical locations 
(compare figure 1, oppositely located performance of 
the two tests) . 

Figures 5 and 6 show the desired behavior of 
the individual processes for the vacuum test 103 and 
the scan test 104, figure 5 showing a sequential 
processing of the two tests and figure 6 showing a 
parallel processing of the two tests. In the parallel 
processing in figure 6, blocking of the two individual 
processes can occur due to the fact that after the 
event "recovery vacuum", one of the two events "turn" 
or "counter" will not occur. As a result, a turning 
("turn" command) of the cylinder head, which is needed 
by both individual processes running in parallel, is 
not guaranteed. Whereas one machine wants to turn the 
cylinder head, the other machine 
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wants to increment the counter, resulting in blocking. 
In contrast, sequential processing as indicated in 
figure 5 is possible, the tests for 12 vacuum pipettes 
102 each being performed in succession and thus the 
5 cylinder head 101 having to be turned twice completely. 
The time expenditure for the sequential processing is 
far greater than for (almost) parallel processing. 

On the basis of figure 4, figure 5 to figure 10 
can be analogously understood per se. Thus, figure 5 
10 comprises states 501 to 517, figure 6 comprises states 
601 to 618, states 501 to 509 and 509 to 517 
characterizing the in each case independent machines 
according to figure 6 which can run in parallel. The 
event which is in each case decisive for a state 
15 changing to another one is in each case indicated along 
the transition arrows in the figures. 

Events having the same name occur synchronously 
in machines in which the respective event is defined. 
In the present exemplary embodiment, the event "scan" 
20 occurs if the state machine of the system behavior 
(compare figure 7) is in state "0" or, respectively, 
the state machine of the specific system behavior 
according to figure 8 is in state 0 or in state 1 and 
if the state machine of the specific system behavior 
25 according to figure 9 is in state 2. 

Controllable events are: 
"turn", "scan", "vacuum", "recover", "recovery 
turn", "recovery scan", "recovery vacuum", 
"counter", "operator input", "reset". 
30 Uncontrollable events are: 

"done turn", "error turn", "done scan", "error 
scan", "done vacuum", "error vacuum", "done 
recover", "counter=12?", "counter<12?", "stop", 
"repeat". 



35 
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The respective state machine indicates the 
state in which the corresponding system behavior can be 
terminated, i.e. the state with a dark background 
defines a termination condition. 
5 Figure 7 shows the system behavior. As already 

mentioned above, the system behavior shows sequences of 
events which represent physically possible system 
states. Such physically possible behaviors are the 
turning of the cylinder head, the performance of the 
10 vacuum test, the performance of the scan test, the 
incrementing and interrogating of the counter and the 
inputting of a command which triggers a predetermined 
action. The state 0 in figure 7 characterizes both the 
initial state and the end state of the respective 
Q 15 system behavior. 

ri After the system behavior has been identified, 

Py the specific system behavior is determined which 

relates to a behavior of the complete process with 
S regard to the task to be controlled. The associated 

C3 20 state machine for the specific system behavior of the 

error recovery is shown in figure 8. In figure 8, there 
ill are two marked states 801 and 807 , state 801 being 

O simultaneously the start and an end state of the state 

X? machine. The specific system behavior "error recovery" 

25 can be terminated in each case in states 801 and 807. 

According to the above statements, the 
validation is then performed. To this end, a number of 
iterations which, finally, lead to the solution 
according to figure 7 to figure 9 are shown according 
30 to figure 2 (compare transition from validation 202 to 
structuring 201: iteration). 

Figures 8 and 9 show the controlled specific 
system behavior corresponding to the predetermined 
functionality of the complete process. For this 
35 purpose, three tasks have been identified 
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which are executed in parallel: error recovery, scan 
test and vacuum test. The error recovery, in 
particular, is only activated if both the scan test 104 
and the vacuum test 103 [lacuna] in a marked state 
5 (compare state 6 or, respectively states 907, 917 in 
figure 9) . The scan test 104 and the vacuum test 103 
are only activated if the error recovery is in the 
initial state (compare state 0 or 801 in figure 8) . 

The system behavior and the specific system 

10 behavior according to figures 7-9 are non-blocking. 
Furthermore, the specific system behavior according to 
figures 8 and 9 is controllable with respect to the 
system behavior from figure 7. 

In figure 10, the complete process is assembled 

15 from the state machines according to figures 7-9. 
Figure 10 represents the product state machine of the 
state machines described and is comprehensible per se. 
In particular, the product state machine according to 
figure 10 is not used for structuring and solving the 

20 control task for the complete process since the easily 
traceable procedure, as described, guarantees a 
structured and clear approach to determining the data 
which are necessary for controlling the complete 
process . 

25 The executable program code for controlling the 

complete process is automatically generated in that 
first function calls are assigned to the controllable 
events, the return values of the function calls or 
output values of sensors being assigned the 

30 corresponding uncontrollable events. The program code 
for controlling the complete process is generated from 
the state machine assignments and associated program 
code fragments. 
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Patent claims 



1. A method for designing the control of a 
complete process which comprises a number of individual 

5 processes, 

a) in which functionalities of the individual 
processes are identified, 

b) in which a validation is performed by 
automatically verifying an interplay of the 

10 functionalities in accordance with an input to the 

complete process, to the effect that each 
individual process is not impeded during the 
operation, 

c) in which data for controlling the complete process 
15 are determined from a result of the validation. 

2. The method as claimed in claim 1, in which a 
sequence optimization is performed in addition to step 
1c) . 

3. The method as claimed in claim 1 or 2, in which 
20 the data for the control are determined in the form of 

an executable code. 

4. The method as claimed in one of claims 1 to 3, 
in which one of the functionalities of the individual 
processes is a software unit for controlling the 

25 individual process affected. 

5. The method as claimed in one of the preceding 
claims, in which an individual process is impeded if 
one of the following conditions is met: 

a) the individual process is blocked by another 
30 individual process; 

b) the individual process reaches an unauthorized 
state or a state endangering the operation of the 
complete system. 
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6. The method as claimed in one of the preceding 
claims, in which the control of individual processes of 
an automatic placement machine is designed. 

7. The method as claimed in one of the preceding 
claims, in which the data determined for controlling 
the complete process are used for controlling a 
technical installation . 

8. An arrangement for designing the control of a 
complete process which comprises a number of individual 
processes, comprising a processor unit which is set up 
in such a manner that 

a) functionalities of the individual processes can be 
identified; 

b) a validation can be performed by automatically 
verifying an interplay of the functionalities in 
accordance with an input to the complete process, 
to the effect that each individual process is not 
impeded during the operation; 

c) data from a result of the validation can be used 
for controlling the complete process. 
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Abstract 

Method and arrangement for designing the control of a 
complete process 

To prevent blocking between competing 
individual processes within a complete process , 
functionalities of the individual processes are 
identified and the interplay of these functionalities 
is validated. The data obtained from the validation can 
be used for controlling the complete process. 
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POWER OF ATTORNEY: As a named inventor, I 
hereby appoint the following attorney(s) and/or 
agent(s) to prosecute this application and transact all 
business in the Patent and Trademark Office connec- 
ted therewith. (list name and registration number) 



And I hereby appoint 

Messrs. John D. Simpson (Registration No Jh9JS42)J_ewis T. Stead ma n^lZjQZ^ William C. Stueber (46453). P. Phillips Connor (1 9*259), Dennis A. Gross 
(2441Q), Marvin Moody^lfi^S^ Steven H. NoJIj28*3$2), Brett A. ValiqueH2^S44), Thomas 1. Rdss (29,275), Kevin W. Guynnj2%927), Edward A. Lehmann 
Q2£\2)> James D. Hobart jgdJi^L Robert M. BarrettJ30J42), James Van Sante n (16,584 ), J. Arthur Gro ss (1.^ 615), Richard J. Schwajsjtia.422) and 
Melvin A. Robinson (31^70^ David R. Metzger (32,919), John R. GarrettJ27JS88£ all members of the firm of Hill, Steadman & Simpson, A Professional Corpo- 
ration. 



Telefongesprache bitte richten an: 
(Name und Tefefonnummer) 



Direct Telephone Calls to: (name and telephone num- 
ber) 

312/876-0200 
Ext. 



Postanschrift Send Correspondence to: 

HILL, STEADMAN & SIMPSON 
A Professional Corporation 
85th Floor Sears Tower, Chicago, Illinois 60606 



Voller Name des einzigen oder ursprunglichen Erfinders: 

BRANDIN, Bertil \ 


Full name of sole or first inventor: 


Unterschi% des Ertihdars" Datum 


Inventor's signature Date 


Wohnsitz 

D-80469JV[unchen\Germany \jEy, 


Residence 


Staatsangehqrigkeit ~" 

Schweden 


Citizenship 


Postanschrift 

Baumstr. 11 


Post Office Addess 


D-80469 Munchen 
Bundesrepublik Deutschland 




Voller Name des zweiten Miterfinders (falls zutreffend): 

KALTENBACH, Markus\ 


Full name of second joint inventor, if any: 


Unterschrift des bffinderr™""" ~" Datum 

H.httUUicLtA 2\.6,mn 


Second Inventor's signature Date 


Wohnsitz 

D-80801 MunchenXGermany O^X 


Residence 


StaatsangehHrigkelt "^-i- 

Bundesrepublik Deutschland 


Citizenship 


Postanschrift 

Konradstr. 10A 


Post Office Address 


D-80801 Munchen 
Bundesrepublik Deutschland 





(Bitte entsprechende fnformationen und Unterschriften im (Supply similar information and signature for third and 



Falle von dritten und weiteren Miterfindern angeben). subsequent joint inventors). 
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